Techie BabajiLearn to Code. Build Real Skills.
IIS (Internet Information Services) · Security

Authentication

Authentication answers “who is this user?”. IIS can authenticate users before the request even reaches your app.

Intermediate 5 min Lesson 16 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:HTTPS and SSL Certificates
0/33 in IIS
On this page · 5 min · Intermediate

On this page

  1. In simple words
  2. Learning objectives
  3. Explanation
  4. Code example
  5. Step by step
  6. Real-world use
  7. Common mistakes
  8. Best practices
  9. Remember this
  10. Practice exercise
  11. Mini quiz
  12. Related topics
  13. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 30, 2026

Related tutorials

Interview questions

In simple words#

Anonymous is an open museum — anyone can walk in. Windows authentication is a company office where your employee badge opens the door automatically. Basic authentication is a guard asking for your username and password at the door (only safe if the conversation is private — HTTPS).

Anonymous
No login; IIS uses IUSR or the pool identity.
Windows authentication
Domain users signed in automatically (Kerberos/NTLM).
401.2
Error when no enabled method matches.

Learning objectives#

  • Enable and disable authentication methods
  • Configure Windows authentication for intranet apps
  • Use authentication in ASP.NET Core
  • Avoid insecure Basic authentication

Explanation#

Each site or application chooses which methods are enabled. Public sites: Anonymous only. Intranet: Windows authentication, Anonymous disabled.

Windows authentication uses Kerberos or NTLM; domain users in Edge/Chrome sign in without typing passwords.

In ASP.NET Core, IIS passes the Windows user to the app: builder.Services.AddAuthentication(IISDefaults.AuthenticationScheme) and [Authorize].

Basic authentication sends credentials in every request (Base64, not encrypted) — only ever over HTTPS, and preferably not at all.

Code example: Intranet site with Windows authentication#

PowerShellIntranet site with Windows authentication Illustrative
# Authentication sections are locked at server level, so set them for the site in applicationHost.config
Set-WebConfigurationProperty -PSPath "MACHINE/WEBROOT/APPHOST" -Location "HrPortal" `
  -Filter "system.webServer/security/authentication/anonymousAuthentication" -Name enabled -Value $false
Set-WebConfigurationProperty -PSPath "MACHINE/WEBROOT/APPHOST" -Location "HrPortal" `
  -Filter "system.webServer/security/authentication/windowsAuthentication" -Name enabled -Value $true


# ASP.NET Core (Program.cs):
# builder.Services.AddAuthentication(Microsoft.AspNetCore.Server.IISIntegration.IISDefaults.AuthenticationScheme);
# builder.Services.AddAuthorization();
# app.UseAuthentication(); app.UseAuthorization();
# In a controller: User.Identity.Name  → "CORP\asha"
Expected output
Employees open https://hr.corp.example and are signed in automatically; the app sees User.Identity.Name = CORP\asha.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. Anonymous authentication is disabled for the site.
  2. Windows authentication is enabled.
  3. The setting is stored per site in applicationHost.config because the section is locked.
  4. ASP.NET Core reads the Windows identity through IIS integration.

Real-world use case#

An internal leave-management portal uses Windows authentication so staff never create separate passwords.

Common mistakes#

Both Anonymous and Windows enabled for a protected app

Anonymous wins for requests that don’t require auth. Disable Anonymous or use [Authorize] everywhere.

Basic authentication over HTTP

Passwords travel almost in plain text. Always HTTPS — prefer Windows or token-based auth.

Best practices#

  • Anonymous for public sites
  • Windows auth for intranet apps
  • HTTPS for any credential exchange
  • Combine with authorization rules or [Authorize]

Remember this#

Anonymous = public. Windows = domain badge.

Basic only over HTTPS (better: avoid).

401.2 = no allowed auth method succeeded.

Practice exercise#

Your task: Where would you check if a domain user gets prompted for a password instead of signing in automatically?

Show solution
Text Illustrative
The site must be in the browser’s Local intranet zone (or allowed list), Windows auth must use Negotiate, and the SPN must be correct for Kerberos.

Mini quiz#

Authentication quizMultiple choice Question 1 of 1

Which method signs domain users in automatically on an intranet?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.